New Attack Paths? AS Requested Service Tickets

Elad Shamir details SPN-jacking: with WriteSPN rights over a target SPN and another service account, an attacker lacking SeEnableDelegation can temporarily hijack the SPN and run a full S4U attack—reviving dead-end paths.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Eleven risks that survive AD migrations — inherited admin rights, recreated attack paths, SID-history abuse and more — and how a security-first approach keeps legacy exposure out of the new forest.

Unconstrained delegation lets a service impersonate users across the domain; attackers hunt such servers, capture Kerberos TGTs with Rubeus, and move laterally. Mechanics and remediation covered.

AS-REP Roasting targets accounts with Kerberos pre-authentication disabled: attackers request an encrypted response and crack it offline. The post shows finding and fixing them with Purple Knight.

Password spraying tests a few weak passwords across many accounts, dodging lockouts; Microsoft ties over a third of compromises to it. Covers delayed and Kerberos pre-auth variants plus detection.